[Full-Disclosure] Virus / Trojan
From: Otero, Hernan (EDS) (HOtero_at_lanchile.cl)
To: email@example.com Date: Fri, 9 Jan 2004 15:47:43 -0400
Today found this suspicious file attached to an email, obviously is a virus
(our AV donīt detect it :-( ). The virus/trojan is very simple, the
developer only put effort in obfuscate the strings inside the binary.
The executable file try to connect to gamemaniacs.org and download a file.
This file will be located in the system directory
The url used in the GET is:
This will download the binary saved as msvchost.exe
any one know what virus/trojan is this?
Full-Disclosure - We believe in it.
- text/plain attachment: VIRUS1_DETECTED_AND_REMOVED_winxp_sp1_VIRINFO.TXT